United Airlines Flight 232

United Airlines Flight 232 was a scheduled flight from Stapleton International Airport, in Denver, Colorado, to O'Hare International Airport in Chicago, with continuing service to Philadelphia International Airport. On July 19, 1989, the DC-10 (Registration Template:Airreg) suffered an uncontained failure of its number 2 engine. Shrapnel was hurled from the engine with enough force to penetrate the hydraulic lines of all three of the aircraft's hydraulic systems. The hydraulic fluid from each system rapidly leaked from the aircraft, resulting in the inability of the crew to move the flight control surfaces. Only the thrust levers for the two remaining engines remained workable, so the crew had limited control by using thrust modulation (symmetric thrust for pitch, differential thrust for yaw/roll). The aircraft eventually broke up during an emergency landing on the runway at Sioux City, Iowa, killing 110 of its 285 passengers and one of the 11 crew members. One additional passenger died of his injuries 31 days after the crash.
Owing to the skill of the crew and a DC-10 instructor pilot who happened to be a passenger on the aircraft, 174 passengers and 10 crew members survived the crash. The disaster is considered an example of successful Crew Resource Management, due to the effective use of all available resources for help during the emergency.[1]

Contents

The flight took off at 14:09 (CDT) from Stapleton International Airport, Denver, Colorado, bound for O'Hare International Airport in Chicago, Illinois with ongoing service to Philadelphia International Airport in Philadelphia, Pennsylvania. At 15:16, while the plane was in a shallow right turn at 37,000 feet, the fan disk of its tail-mounted General ElectricCF6-6 engine failed and disintegrated. The debris from the failed disk was not contained by the engine's nacelle. Pieces of the structure penetrated the aircraft tail section in numerous places, including the horizontal stabilizer. The pieces of shrapnel punctured the lines of all three hydraulic systems, allowing the fluid to rapidly drain away.[2]
Captain Alfred C. Haynes and his flight crew (First Officer William Records, who was flying, and Second Officer Dudley Dvorak, flight engineer) felt a jolt going through the aircraft. Warning lights illuminated and indicated that the autopilot had disengaged and the tail-mounted number two engine was malfunctioning. The co-pilot noticed that the airliner was off course, and moved his control column to correct this, but the plane did not respond. The flight crew discovered that the pressure gauges for the three hydraulic systems were registering zero, and they realized that the initial failure had left all control surfaces immovable. The three hydraulic systems were separate, such that a single event in one system would not disable the other systems, but lines for all three systems shared the same Template:Convert route through the tail where the engine debris penetrated, and beyond that there was no backup system, a fact which the NTSB later recommended be remedied.[3]
Due to the damage in the tail, the plane had a continual tendency to turn right, and without flight controls was difficult to maintain on a stable course. It began to slowly oscillate vertically in a phugoid cycle, which is characteristic of planes in which control surfaces command is lost. With each iteration of the cycle the aircraft lost approximately 1,500 feet of altitude. Dennis E. Fitch, an off-duty UAL DC-10 flight instructor, was seated in the first class section and offered his assistance. After entering the cockpit, Fitch discovered that the flight crew had resorted to a method of controlling the aircraft through adjusting the throttles of the remaining two engines; running one engine faster than the other to turn the plane (differential thrust) and accelerating or decelerating in order to gain or lose altitude (symmetric thrust). Using this method, it was possible to mitigate the phugoid cycle and make rough steering adjustments. At one point Fitch manually lowered the landing gear in flight, hoping that this would force trapped hydraulic fluid back into the lines, allowing some movement of control surfaces. Although the gear lowered successfully, there was no improvement in control response, as all the fluid had been lost through the punctured lines.
Air traffic control (ATC) was contacted, and an emergency landing at nearby Sioux Gateway Airport was organized.
Haynes kept his sense of humor during the emergency, as recorded on the plane's CVR:

Fitch: I'll tell you what, we'll have a beer when this is all done.

Haynes: Well I don't drink, but I'll sure as hell have one.

and later:

Sioux City Approach: United Two Thirty-Two Heavy, the wind's currently three six zero at one one; three sixty at eleven. You're cleared to land on any runway.

Haynes: [laughter] Roger. [laughter] You want to be particular and make it a runway, huh? (Haynes was alluding to the extreme difficulty in controlling the aircraft and their extremely low chances of making it to the airport at all)[4]

A more serious remark often quoted from Haynes was made when ATC asked the crew to make a left turn to keep them clear of the city:

Haynes later noted that "We were too busy [to be scared]. You must maintain your composure in the airplane or you will die. You learn that from your first day flying."[6]
Landing was originally planned on the Template:ConvertRunway 31. The difficulties in controlling the aircraft made lining up almost impossible. While dumping excess fuel, the plane executed a series of mostly right-hand turns (it was easier to turn the plane in this direction) with the intention of coming out at the end lined up with runway 31. When they came out they were instead left with an approach on the shorter Runway 22 of 6,600 feet (2012 m), with little capacity to maneuver.[3]
Fire trucks had been placed on runway 22,[7] anticipating a landing on runway 31, and there was a scramble as the trucks rushed out of the way. All the vehicles parked there got out of the way before the plane touched down.
Fitch continued to control the aircraft's descent by adjusting engine thrust. With the loss of all hydraulics, the crew were unable to control airspeed independent from sink rate. On final descent, the aircraft was going 240 knots and sinking at 1,850 feet per minute, while a safe landing would require 140 knots and 300 feet per minute. The aircraft began to sink faster while on final approach and veer to the right. The tip of the right wing hit the runway first, spilling fuel, which ignited immediately. The tail section broke off from the force of the impact, and the rest of the aircraft bounced several times, shedding the landing gear and engine nacelles and breaking the fuselage into several main pieces. On the final impact the right wing was sheared off, and the main part of the aircraft skidded sideways, rolled over on to its back, and slid to a stop upside down in a corn field to the right side of runway 22. Witnesses reported that the aircraft cartwheeled, but the investigation did not confirm this.[3] News reports that the aircraft cartwheeled were due to misinterpretation of the video of the crash that showed the flaming right wing tumbling end-over-end. Debris from Engine #2 (including the fractured fan disk) and other parts from the tail structures of the plane were later found on farmland near Alta, Iowa, approximately Template:Convert northeast of Sioux City.[3]

Of the 296 people on board, 111 died in the crash. Most were killed by injuries sustained in the multiple impacts, but 35 people in the middle fuselage section directly above the fuel tanks died from smoke inhalation in the post-crash fire. Of those, 24 had no traumatic blunt-force injuries. The majority of the 185 survivors were seated behind first class and ahead of the wings.[5] Many passengers were able to walk out through the ruptures to the structure, and in many cases got lost in the high field of corn adjacent to the runway until rescue workers arrived on the scene and escorted them to safety.
Of all of the passengers:[3]

35 died due to smoke inhalation (None were in first class)

76 died for reasons other than smoke inhalation (17 were in first class)

47 were seriously injured (8 were in first class)

125 had minor injuries (1 was in first class)

13 had no injuries (None were in first class)

The passengers who died for reasons other than smoke inhalation were seated in rows 1-4, 24-25, and 28-38. Passengers who died due to smoke inhalation were seated in rows 14, 16, and 22-30. A person assigned to 20H moved to an unknown seat and died due to smoke inhalation.
One crash survivor died 31 days after the accident; in accordance with official rules, the NTSB classified his injuries as "serious." [3]
Fifty-two children, including four lap children, were on board the flight due to the United Airlines "Children's Day" promotion. Eleven children, including one lap child, died.[8] Many of the children had traveled alone.[9]

Investigation attributed the cause of the accident to a failure of United Airlines maintenance processes to detect an existing fatigue crack.[3] Post-crash analysis of the crack surfaces showed the presence of a penetrating fluorescent dye used to detect cracks during maintenance. The presence of the dye indicated that the crack was present and should have been detected at a prior inspection. The detection failure arose from poor attention to human factors in United Airlines' specification of maintenance processes.
The cause of the crack in the fan disk itself was traced back to the Alcoafoundry from which the engine part was sourced. It turned out that there was a defect in elimination of gaseous anomalies during the purifying of the titanium disk ingot. An excess amount of nitrogen was in the material, causing a 'hard alpha inclusion' which cracked during forging and then fell out during final machining, forming a cavity with microscopic cracks at the edges. During the engine's normal running cycle, one of these cracks grew slowly each time the engine was powered up and brought to operating temperature, until it grew large enough for the disk to fail structurally.[3] Newer batches used much higher melting temperatures and a 'triple vacuum' process to eliminate these impurities.
The subsequent investigation and Airworthiness Directive also revealed several other fan disks already in service from the same batch of ingots which had started to exhibit the initial cracking symptoms of part failure.

The National Transportation Safety Board investigation reported that after subsequent reconstructions of the accident in flight simulators, it was deemed that training for such an event involved too many factors to be practical. While some level of control was possible, no precision could be achieved, and a landing under these conditions was stated to be "a highly random event". The NTSB further noted that "under the circumstances the UAL flightcrew performance was highly commendable and greatly exceeded reasonable expectations."[3]
Because this type of aircraft control is difficult for humans to achieve, some researchers have attempted to integrate this control ability into the computers of fly-by-wire aircraft. Early attempts to add the ability to real airplanes were not very successful; the software was based on experiments conducted in flight simulators where jet engines are usually modeled as "perfect" devices with exactly the same thrust on each engine, a linear relationship between throttle setting and thrust, and instantaneous response to input. Later, computer models were updated to account for these factors, and planes have been successfully flown with this software installed.[10]
Newer aircraft designs such as the MD-11 have incorporated hydraulic fuses to isolate a punctured section and prevent a total loss of hydraulic fluid; this was also partially implemented on DC-10 models after the accident.[5] Should a similar event occur in the future, a modified DC-10 is designed to detect the leak and shut off hydraulic system 3's tail section. Although elevator and rudder control will be lost, the pilot will still have pitch control through stabilizer trim, and will have limited use of ailerons and spoilers. Although not an ideal situation, the system provides a greater measure of control than was available to the crew of United 232. In this situation, a safe landing is much more likely.
Of the four children deemed too young to have seats of their own ('lap children'), one died from smoke inhalation.[3] The NTSB added a safety recommendation to the FAA on its "List of Most Wanted Safety Improvements", in May 1999 suggesting a requirement for children under 2 to be safely restrained which was removed in November 2006.[11][12] It also sparked a campaign, led by United Flight 232's senior flight attendant, Jan Brown Lohr, for all children to have seats on aircraft.[13]

Of the 296 people aboard, 111 were killed in the crash, while 185 survived. Captain Haynes later told of three contributing factors regarding the actual time of day that allowed for a better chance of survival:

The accident occurred during daylight hours;

The accident occurred as a shift change was occurring at both a regional trauma center and a regional burn center in Sioux City, allowing for more medical personnel to treat the injured; and

The accident occurred when the Iowa Air National Guard was on duty at Sioux Gateway Airport, allowing for 285 trained personnel to assist with triage and evacuation of the injured.

"Had any of those things not been there," Haynes said later, "I'm sure the fatality rate would have been a lot higher."[14]
As with the Eastern Air Lines Flight 401 crash of a similarly sized Lockheed L-1011 in 1972, the relatively shallow angle of descent likely played a large part in the relatively high survival rate. The National Transportation Safety Board concluded that under the circumstances, "a safe landing was virtually impossible."

Spencer Bailey - Subject of a famous photograph showing Lt. Colonel Dennis Nielsen carrying the three-year-old survivor to safety. His brother, Brandon, also survived the crash, but their mother, Francie, did not. A statue in part of Sioux City's riverfront development is based on the picture. The 1994 memorial commemorates the rescue efforts by the Sioux City community following the crash, featuring contemplative areas and a tree-lined approach with plaques describing the accident. Bailey is a graduate of Dickinson College and Columbia University Graduate School of Journalism and works as an editor and journalist in New York City.

Jerry Schemmel - Radio announcer for the Colorado Rockies Denver's MLB and a former radio announcer for the Denver Nuggets, Denver's NBA basketball team. Also wrote a book about United Airlines Flight 232 titled Chosen to Live, and was credited with saving the life of a child in the crash.

Dennis E. Fitch - A safety consultant to NASA as a member of the Aerospace Safety Advisory Panel.[16] Also a DC-10 pilot and instructor, he helped Captain Al Haynes fly United Airlines Flight 232. "For the thirty minutes I was up there," Fitch said later, "I was the most alive I've ever been. That is the only way I can describe it to you."[14]

Pete Wernick - Prominent banjo player with the Hot Rizebluegrass band and instructor, was on his way to a festival in the Albany, New York area. Wernick walked away from the crash with his young son, and along with his wife, they took a later flight to go to the festival. He gave his personal account of the day's events in the song, "A Day in '89 (You Never Know)". Wernick has yet to release a recording of the song, but has published the lyrics on his website.[17]

Jan Brown Lohr - United 232's Senior Flight Attendant. She was forced by regulation to ask parents with "lap babies" (children without seats) aboard flight 232 to place their children on the cabin floor during the flight's final moments before impact. One of four children died from smoke inhalation. The deceased child's mother came to her at the crash site and stated "You told me to put my baby on the floor and now he's gone." Since then, Lohr has tirelessly lobbied in Washington D.C. to promote the safety of children on all civilian aircraft and airlines, asking that federal regulations require all children to have a seatbelt on every flight.[13]

Ron May - Legal Associate at Winston and Strawn who went on to be an Assistant U.S Attorney for the Northern District of Illinois and then became a teaching pastor at Park Community Church in Chicago. He gave a first person message about this experience and how he and others dealt with the last 20 minutes before the plane crashed.[18]Template:Dead link

The odds of all three hydraulic systems failing simultaneously had previously been calculated as high as a billion to one.[20] Yet, similar flight control failures have occurred:

In 1971, a Pan American 747 struck approach light structures for the reciprocal runway as it lifted off the runway at San Francisco Airport. Major damage to the belly and landing gear resulted, which caused the loss of hydraulic fluid from 3 of its 4 flight control systems. The fluid which remained in the 4th system gave the captain very limited control of some of the spoilers, ailerons and one inboard elevator. That was sufficient to circle the plane while fuel was dumped and then to make a rather hard landing. There were no fatalities, but there were some injuries.

In 1981, an Eastern Airlines L-1011 (also a 3-engine airliner) suffered a similar kind of massive failure of its number two engine. The shrapnel from that engine inflicted damage on all four of its hydraulic systems, which were also close together in the tail structure. Fluid was lost in 3 of the 4 systems. While the fourth hydraulic system was impacted with shrapnel too, it was not punctured. The hydraulic pressure remaining in that fourth system enabled the captain to land the plane safely with some limited use of the outboard spoilers, the inboard ailerons and the horizontal stabilizer, plus differential engine power of the remaining two engines. There were no injuries.

In 1985, Japan Airlines flight 123, a Boeing 747, suffered a rupture of the pressure bulkhead in its tail section. The damage was extensive and caused the loss of fluid in all four of its hydraulic control systems. The pilots were able to keep the plane airborne for almost 30 minutes using differential engine power, but eventually control was lost, and the plane crashed in mountainous terrain. There were only 4 survivors among the 524 on board.

In 1994, RA85656, a Tupolev Tu-154 operating as Baikal Airlines Flight 130 crashed near Irkutsk shortly after departing from Irkutsk Airport, Russia. Damage to the starter caused a fire in engine number two (located in the rear of fuselage). High temperatures during the fire destroyed the tanks and pipes of all three hydraulic systems. The crew lost control of the aircraft. The unmanageable plane, at a speed of 275 knots, hit the ground at a dairy farm and burned. All passengers and crew, as well as a dairyman on the ground, died.

In 2003, OO-DLL, a DHL Airbus A300 was struck by a surface-to-air missile shortly after departing from Baghdad International Airport, Iraq. The missile struck the portside wing, rupturing fuel lines and causing the loss of all three hydraulic systems. With the flight controls disabled the crew was able to use differential thrust to execute a safe landing at Baghdad. This is the first and only documented time anyone has managed to land a transport aircraft safely without working flight controls.

The disintegration of a turbine disc, leading to loss of control, was a direct cause of two major aircraft disasters in Poland.

On 14 March 1980, LOT Polish Airlines Flight 007, an Ilyushin Il-62, attempted a go-around when the crew experienced troubles with gear indicator. When the thrust was applied, low pressure turbine disc in engine number 2 disintegrated because of material fatigue; parts of the disc damaged engines number 1 and 3 and severed control pushers for both horizontal and vertical stabilizers. After 26 seconds of uncotrolled descent, the aircraft crashed, killing all 87 people on board.

On 9 May 1987, improperly assembled bearings in engine no.2 on LOT Polish Airlines Flight 5055 overheated and exploded during cruise over Lipniki village, causing the shaft to break in two; this caused the low pressure turbine disc to spun to enormous speeds and disintegrate, damaging engine no.1 and cutting the control pushers. The crew managed to return to Warsaw, using nothing but trim tabs to control the Il-62M, but on the final approach, the trim controlling links burned and the crew completely lost control over the aircraft. Soon after, it crashed on the outskirts of Warsaw; all 183 on board perished. Had the plane stayed airborne for 40 seconds more, it would have been able to reach the runway.